MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fbd1e4d68f71a88323b609b832d0eae2dbc5a9021bec4a07bae220f1611eee5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fbd1e4d68f71a88323b609b832d0eae2dbc5a9021bec4a07bae220f1611eee5
SHA3-384 hash: 27ae7e87c6638a376816faf1e8ed86f0924752a88d99ae8ee9a10f321ed21323663f20bc57a132379b55cde5cc572515
SHA1 hash: 353a1ef6643045b70932599b39a9c69d73c3f80d
MD5 hash: df1913bf77cd50ca71ca3ee975e38837
humanhash: romeo-yankee-nuts-white
File name:Cobro Juridico_0380964647_1780563_1341011992082976_096834_217917682736148259_4889977975821.tgz
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:600'441 bytes
First seen:2020-11-20 07:54:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:GjD+5gRVJXCn9ahwVbt+q3LFxMDRRSWDvIW1gDN1e5CeImKzWFf:++yLm9amVbAOL6LBTmDnQCFxWFf
TLSH 23D423C7FCBDFD9634AE02D524CF00903EA1B7225673986963B6860AB5D9C75B1348E3
Reporter abuse_ch
Tags:Outlook RAT RemcosRAT tgz


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: EUR04-DB3-obe.outbound.protection.outlook.com
Sending IP: 40.92.74.82
From: Prima Donna sas <primadonna2018@hotmail.com>
Subject: COBRO JURIDICO SERFINANZA.
Attachment: Cobro Juridico_0380964647_1780563_1341011992082976_096834_217917682736148259_4889977975821.tgz (contains "Cobro Juridico_0380964647_1780563_1341011992082976_096834_217917682736148259_4889977975821_pdf.exe")

RemcosRAT C2:
databasepropersonombrecomercialideasearchwords.services:7580 (186.169.53.6)

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5fbd1e4d68f71a88323b609b832d0eae2dbc5a9021bec4a07bae220f1611eee5/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l66r4tli64niqmr3mcnygliovyw3ywuqeg7mjid3vyra6fqr53sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

rar 5fbd1e4d68f71a88323b609b832d0eae2dbc5a9021bec4a07bae220f1611eee5

(this sample)

RemcosRAT

Executable exe 2123aaf55e2f25a5162c742f31d52ef92dab582db297a8a3f246741ab0cccf74

  
Dropping
MD5 2734afb9c14e820767f474cce3ac8e67
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2123aaf55e2f25a5162c742f31d52ef92dab582db297a8a3f246741ab0cccf74

Comments